[ntar-workers] Re: Major rework / review of pcapng file format in CVS - please review

[Guy Harris]

Gianluca Varenni wrote:

> - if_fcslen option: it's not clear what to write in this field when the 
> FCS is variable. 0 and the right effective FCS length in each packet? 
> having the effective FCS length in an option is a bit dumb in my opinion 
> (if we do not have a way to declare that the FCS length is in the 
> option, properly decoding the packets will always require decoding the 
> options of the packet block!

"In a option" meaning "in an option in the Interface Description Block" 
or "in an option in the Packet Block or Enhanced Packet Block"?

There are two reasons for a per-packet FCS length:

	1) to handle the case where the FCS length is variable (e.g., PPP) and 
it changes in the course of a session;

	2) to be one way of handling the case where the capture isn't passive - 
i.e., the capture includes packets transmitted by the machine doing the 
capture - and those packets don't have the FCS included.

If outgoing packets *never* include the FCS, 2) could also be handled 
with the packet direction information.